[denta]

You could collect netflow data on the firewall (see pflow(4)) and analyze that for offending IP's. Or for a long term solution perhaps look into restricting outbound traffic with authpf(8).